summaryrefslogtreecommitdiffstats
path: root/src/mame/drivers/cps1.cpp
diff options
context:
space:
mode:
author Robbbert <Robbbert@users.noreply.github.com>2022-03-26 22:17:12 +1100
committer Robbbert <Robbbert@users.noreply.github.com>2022-03-26 22:17:12 +1100
commita229f29182a122814801c06165fb65625eec9da9 (patch)
treec271c906604bd5e82360db1ded88e0b9f4574042 /src/mame/drivers/cps1.cpp
parent62e60b54caa5fd5738a352635bebd4b895e88e66 (diff)
parent2593201bc3ede22769221bc92c9a3f88fee5ceb0 (diff)
Merge remote-tracking branch 'upstream/master'
Diffstat (limited to 'src/mame/drivers/cps1.cpp')
-rw-r--r--src/mame/drivers/cps1.cpp254
1 files changed, 254 insertions, 0 deletions
diff --git a/src/mame/drivers/cps1.cpp b/src/mame/drivers/cps1.cpp
index d42cb8714f2..61a101d22fd 100644
--- a/src/mame/drivers/cps1.cpp
+++ b/src/mame/drivers/cps1.cpp
@@ -3081,6 +3081,70 @@ static INPUT_PORTS_START( pang3b )
PORT_DIPUNUSED( 0x80, 0x80 )
INPUT_PORTS_END
+/* The bootleggers hacked main code (@ 0x300 and 0xe0000) to use dip switches instead of the usual pang3 93C46 serial EPROM */
+static INPUT_PORTS_START( pang3b4 )
+ // Though service mode shows diagonal inputs, the flyer and manual both specify 4-way joysticks
+ PORT_INCLUDE( cps1_2b_4way )
+
+ PORT_MODIFY("IN0")
+ PORT_SERVICE_NO_TOGGLE( 0x40, IP_ACTIVE_LOW )
+
+ // As manual states, "Push 2 is not used," and is not even shown in service mode
+ PORT_MODIFY("IN1")
+ PORT_BIT( 0x0010, IP_ACTIVE_LOW, IPT_BUTTON1 ) PORT_PLAYER(1) PORT_NAME("P1 Shot")
+ PORT_BIT( 0x0020, IP_ACTIVE_LOW, IPT_UNKNOWN )
+ PORT_BIT( 0x1000, IP_ACTIVE_LOW, IPT_BUTTON1 ) PORT_PLAYER(2) PORT_NAME("P2 Shot")
+ PORT_BIT( 0x2000, IP_ACTIVE_LOW, IPT_UNKNOWN )
+
+ PORT_START("DSWA")
+ CPS1_COINAGE_2( "DIP-A" )
+ PORT_DIPUNUSED_DIPLOC( 0x08, 0x08, "DIP-A:4" )
+ PORT_DIPUNUSED_DIPLOC( 0x10, 0x10, "DIP-A:5" )
+ PORT_DIPUNUSED_DIPLOC( 0x20, 0x20, "DIP-A:6" )
+ PORT_DIPUNUSED_DIPLOC( 0x40, 0x40, "DIP-A:7" )
+ PORT_DIPUNUSED_DIPLOC( 0x80, 0x80, "DIP-A:8" )
+
+ PORT_START("DSWB")
+ PORT_DIPNAME( 0x07, 0x04, "Game level" ) PORT_DIPLOCATION("DIP-B:1,2,3")
+ PORT_DIPSETTING( 0x07, "Easy 3" )
+ PORT_DIPSETTING( 0x06, "Easy 2" )
+ PORT_DIPSETTING( 0x05, "Easy 1" )
+ PORT_DIPSETTING( 0x04, "Normal" )
+ PORT_DIPSETTING( 0x03, "Hard 1" )
+ PORT_DIPSETTING( 0x02, "Hard 2" )
+ PORT_DIPSETTING( 0x01, "Hard 3" )
+ PORT_DIPSETTING( 0x00, "Hard 4" )
+ PORT_DIPNAME( 0x18, 0x18, "Player" ) PORT_DIPLOCATION("DIP-B:4,5")
+ PORT_DIPSETTING( 0x08, "1" )
+ PORT_DIPSETTING( 0x10, "2" )
+ PORT_DIPSETTING( 0x18, "3" )
+ PORT_DIPSETTING( 0x00, "4" )
+ PORT_DIPNAME( 0x60, 0x20, "Extend" ) PORT_DIPLOCATION("DIP-B:6,7")
+ PORT_DIPSETTING( 0x00, "30K, 250K, 1M, 3M, 7M" )
+ PORT_DIPSETTING( 0x20, "80K, 500k, 2M, 5M, 10M" )
+ PORT_DIPSETTING( 0x40, "250K, 1M, 3M, 7M, 15M" )
+ PORT_DIPSETTING( 0x60, "Not extend" )
+ PORT_DIPNAME( 0x80, 0x80, "Free play" ) PORT_DIPLOCATION("DIP-B:8")
+ PORT_DIPSETTING( 0x80, DEF_STR( Off ) )
+ PORT_DIPSETTING( 0x00, DEF_STR( On ) )
+
+ PORT_START("DSWC")
+ PORT_DIPUNUSED_DIPLOC( 0x01, 0x01, "DIP-C:1" )
+ PORT_DIPUNUSED_DIPLOC( 0x02, 0x02, "DIP-C:2" )
+ PORT_DIPUNUSED_DIPLOC( 0x04, 0x04, "DIP-C:3" )
+ PORT_DIPUNUSED_DIPLOC( 0x08, 0x08, "DIP-C:4" ) // Missing freeze code @ 0x020B74
+ PORT_DIPNAME( 0x10, 0x10, DEF_STR( Flip_Screen ) ) PORT_DIPLOCATION("DIP-C:5")
+ PORT_DIPSETTING( 0x10, DEF_STR( Off ) )
+ PORT_DIPSETTING( 0x00, DEF_STR( On ) )
+ PORT_DIPNAME( 0x20, 0x20, DEF_STR( Demo_Sounds ) ) PORT_DIPLOCATION("DIP-C:6")
+ PORT_DIPSETTING( 0x20, DEF_STR( Off ) )
+ PORT_DIPSETTING( 0x00, DEF_STR( On ) )
+ PORT_DIPNAME( 0x40, 0x00, DEF_STR( Allow_Continue ) ) PORT_DIPLOCATION("DIP-C:7")
+ PORT_DIPSETTING( 0x40, DEF_STR( No ) )
+ PORT_DIPSETTING( 0x00, DEF_STR( Yes ) )
+ PORT_DIPUNUSED_DIPLOC( 0x80, 0x80, "DIP-C:8" )
+INPUT_PORTS_END
+
// Note: if you have service mode stuck then start button doesn't get recognized on title screen.
static INPUT_PORTS_START( gulunpa )
PORT_INCLUDE( cps1_2b )
@@ -13294,6 +13358,131 @@ ROM_START( pang3b3 )
ROM_LOAD( "cp1b9k.9k", 0x0000, 0x0117, CRC(a754bdc3) SHA1(9267b24cbddee4858b219468cc92f9df8f5fd0ef) )
ROM_END
+/* This bootleg uses a bootlegged B board nearly identical to that used in sf2ceblp.
+ In my set:
+ - Board-A is missing so I don't know if a normal or a dash board was used.
+ - Board-C is an hacked 88622-C-5 with an unusual CPS-B-12 and clearly it's not its C-board because
+ code analisys led to identify the CPS_B_21_DEF as the right configuration.
+ - Board-B has some missing components:
+ - audio cpu code EPROM @B13 (pang3b pa3_11.11f used instead)
+ - 28 pin DIP component @F8, probably a PIC16C55/7 looking the pinout (VCC on pin2, GND on pin 4, ...)
+
+ The program code is almost the same as of pang3b with some minor, yet interesting, hacks:
+ - Dip switch use for board configuration (code@ 0x000300, 0xe0000) instead of a serial EPROM
+ - Removed freeze from dip switch (code@ 020B74)
+ - Some code to handle the PIC (protection?).
+ Read and write to addresses 0x5762b0 and 0x57a2b0 occurs in the code but the return value is never really used (nop or bra skips relevant parts)
+ and so seems that the PIC protection is ineffective.
+ - Read and write to port 0x80017a (EEPROM in pang3) still are present in the code, but are filtered by the PAL16V8 @ E13 so there is no need to
+ create a port for that address here in mame (altough this causes a popmessage "CPS-B read port 3A contact MAMEDEV" to occurr at startup if compiled with
+ DEBUG=1)
+
+ Board-B has five PALs:
+ - PALCE16V8 @A2
+ - PAL16L8 @E11
+ - PALCE16V8 @E13
+ - PAL16L8 @J8
+ - PALCE22V10 @J8
+
+*/
+ROM_START( pang3b4 )
+ ROM_REGION( CODE_SIZE, "maincpu", 0 ) /* 68000 code */
+ ROM_LOAD16_BYTE( "22.u30", 0x00000, 0x20000, CRC(bf3ebe68) SHA1(10f3eb3f6e747eaed1821c611fa19350c3528362) )
+ ROM_LOAD16_BYTE( "26.u35", 0x00001, 0x20000, CRC(d20db83c) SHA1(ac97ad76848bb6069e6d07d1f2feb2c328578228) )
+ ROM_LOAD16_BYTE( "23.u31", 0x40000, 0x20000, CRC(94d494c2) SHA1(33a2c1ea041a68655b7c3c44b1c5d58dec3add89) )
+ ROM_LOAD16_BYTE( "27.u36", 0x40001, 0x20000, CRC(38e43390) SHA1(ae346c5e21b3aad86b118a0c99a550304916debf) )
+ ROM_LOAD16_BYTE( "20.u28", 0x80000, 0x20000, CRC(8daf3814) SHA1(a83a0434b9f281c70dae35362741f52a8b3ea622) )
+ ROM_LOAD16_BYTE( "24.u33", 0x80001, 0x20000, CRC(bb34e444) SHA1(2cfb135dbd763f327fe3c5ed2d8d291fd97118c2) )
+ ROM_LOAD16_BYTE( "21.u29", 0xC0000, 0x20000, CRC(54d0b680) SHA1(5527673286dc9db82eed357cda1f53ccdd3e2d1f) )
+ ROM_LOAD16_BYTE( "25.u34", 0xC0001, 0x20000, CRC(d666ec70) SHA1(3305fa5c6c78bdfc5ef5393f001e710ce3c4d28a) )
+
+
+ ROM_REGION( 0x400000, "gfx", 0 )
+ ROM_LOAD64_BYTE( "14.u25", 0x000000, 0x40000, CRC(d2b764a9) SHA1(bb13821a1a3059c2f98d5c36f830116b87583312) )
+ ROM_LOAD64_BYTE( "06.u15", 0x000001, 0x40000, CRC(fb68be4e) SHA1(5d7e34bfa5427a1b05b64e174dd26e2153b56ec0) )
+ ROM_LOAD64_BYTE( "13.u24", 0x200000, 0x40000, CRC(0c73a1c7) SHA1(c3d3f9115b24805f038bb4b808beef342c87eff3) )
+ ROM_LOAD64_BYTE( "05.u14", 0x200001, 0x40000, CRC(475a5ef1) SHA1(0dcd8d747a84037e27c5b360733a4c3d03cc43fa) )
+
+ ROM_LOAD64_BYTE( "10.u21", 0x000004, 0x40000, CRC(79673708) SHA1(9b4d972d7ef6592763271976349d65519e0d0dfa) )
+ ROM_LOAD64_BYTE( "02.u11", 0x000005, 0x40000, CRC(f706b466) SHA1(ecdfe160bdfa9c5d4533c43f52868f4e71ee6c8b) )
+ ROM_LOAD64_BYTE( "09.u20", 0x200004, 0x40000, CRC(6e36e963) SHA1(2e46c57516603322ee16e7a7ffa4792c3569f087) )
+ ROM_LOAD64_BYTE( "01.u10", 0x200005, 0x40000, CRC(7d15b9d7) SHA1(b6b39bffb2440c4cfedcdda19e6bcb0a85038ee3) )
+
+ ROM_LOAD64_BYTE( "16.u27", 0x000002, 0x40000, CRC(3e293482) SHA1(c5896b92126f05cfcef46a1d6e4a8986c054d1db) )
+ ROM_LOAD64_BYTE( "08.u17", 0x000003, 0x40000, CRC(7e0ca927) SHA1(eee7df6f8fc11dda0d403b7d43934e3233cf257e) )
+ ROM_LOAD64_BYTE( "15.u26", 0x200002, 0x40000, CRC(a933434f) SHA1(60807e16b87f3e07f59fd14d29a5c54efe54f4af) )
+ ROM_LOAD64_BYTE( "07.u16", 0x200003, 0x40000, CRC(83b3fa5e) SHA1(95c79cfe88902a36a60ebd73490b435c57c9d60e) )
+
+ ROM_LOAD64_BYTE( "12.u23", 0x000006, 0x40000, CRC(3c4dfb4f) SHA1(638078080d49edb8c711dfb10ee6029c58e82801) )
+ ROM_LOAD64_BYTE( "04.u13", 0x000007, 0x40000, CRC(44cd5e95) SHA1(53ba6dd7ab2313b5a0ee1210a1ec24e57d1d5d86) )
+ ROM_LOAD64_BYTE( "11.u22", 0x200006, 0x40000, CRC(29194b90) SHA1(479bbfbc26cd18440fdf9b71f85e3776add61cc4) )
+ ROM_LOAD64_BYTE( "03.u12", 0x200007, 0x40000, CRC(7e28974e) SHA1(d1eb177fe37784c6bcd5cb7df3b06b55c4d069b8) )
+
+ ROM_REGION( 0x18000, "audiocpu", 0 ) /* 64k for the audio CPU (+banks) */
+ ROM_LOAD( "pa3_11.11f", 0x00000, 0x08000, BAD_DUMP CRC(cb1423a2) SHA1(3191bf5d340168647881738cb2aed09b1d86146e) ) // 19.u9 missing, used pang3b audio code instead
+ ROM_IGNORE( 0x18000 )
+
+ ROM_REGION( 0x40000, "oki", 0 ) /* Samples */
+ ROM_LOAD( "pa3_05.10d", 0x00000, 0x20000, CRC(73a10d5d) SHA1(999465e4fbc35a34746d2db61ad49f61403d5af7) ) // 18.u18 has the same content of pa3_05.10d from pang3 romset
+ ROM_LOAD( "pa3_06.11d", 0x20000, 0x20000, CRC(affa4f82) SHA1(27b9292bbc121cf585f53297a79fe8f0d0a729ae) ) // 17.u19 has the same content of pa3_06.11d from pang3 romset
+
+ ROM_REGION( 0x0400, "bboardplds", 0 )
+ ROM_LOAD( "pal16l8.11e", 0x0000, 0x0117, CRC(27617943) SHA1(eb34cfba18fcc2b67ee214c681ea86bfe1bb75e0) ) // Bruteforced
+ ROM_LOAD( "pal16v8.1a", 0x0000, 0x0117, CRC(78c3161f) SHA1(7ae85dfca59387f4874b0ef1218bfd14c393fb85) ) // Bruteforced
+ ROM_LOAD( "pal16v8.13e", 0x0000, 0x0117, CRC(5406caf1) SHA1(6bebafd4a4bad9ed766abce2fef9c30cbf61772e) ) // Bruteforced
+ ROM_LOAD( "pal22v10.j8", 0x0000, 0x02dd, CRC(a9445f88) SHA1(caacee5f3d5502cd51060c0769914cad4317838c) ) // Bruteforced
+ ROM_LOAD( "pal16l8.j8", 0x0000, 0x0117, NO_DUMP ) // Bad PAL, all outputs are fixed high
+ROM_END
+
+/* B-Board Mitchell 94916-10 */
+/* This set comes from an encrypted bootleg that uses a very well reproduced Mitchell 94916-10 B-Board surmounted by an
+ original Capcom 90631C-5 C-Board taken from a Knights of the round board (there's a sticker on it).
+ Protection chip MACH215 is present. */
+ROM_START( pang3b5 )
+ ROM_REGION( CODE_SIZE, "maincpu", 0 ) /* 68000 code */
+ ROM_LOAD16_WORD_SWAP( "pa3e_17.11l", 0x00000, 0x80000, CRC(d7041d32) SHA1(b021f3defe7fc58030ba907125c713f987724187) ) // 17.11l has the same content of pa3e_17.11l from pang3r1 romset
+ ROM_LOAD16_WORD_SWAP( "pa3e_16.10l", 0x80000, 0x80000, CRC(1be9a483) SHA1(6cff1dd15ca163237bc82fb4a3e1d469d35e7be8) ) // 16.10l has the same content of pa3e_16.10l from pang3r1 romset
+
+ ROM_REGION( 0x400000, "gfx", 0 )
+ ROM_LOAD64_WORD( "1.2c", 0x000000, 0x80000, CRC(22c934c4) SHA1(93a3c3cfdbfd1321b785f08d1da30d9b1445e14b) )
+ ROM_LOAD64_WORD( "7.2f", 0x000002, 0x80000, CRC(51031180) SHA1(a38a77da2ca452843a3b0cb02baaaf7df2e3d9a4) )
+ ROM_LOAD64_WORD( "3.4c", 0x000004, 0x80000, CRC(ac119a46) SHA1(e8a07349b6106f712a7543ab52e9d5ced756fdbd) )
+ ROM_LOAD64_WORD( "9.4f", 0x000006, 0x80000, CRC(2e1d35f2) SHA1(1b4a9cf9ed91fed532d44582c598982dae06253c) )
+ ROM_LOAD64_WORD( "2.3c", 0x200000, 0x80000, CRC(07c85e9b) SHA1(5b9bc1f5708d03c2458a1dbb781084c2af8f91ee) )
+ ROM_LOAD64_WORD( "8.3f", 0x200002, 0x80000, CRC(325cc0b7) SHA1(ef464abfbadb680eac51daab4adf0bb239785679) )
+ ROM_LOAD64_WORD( "4.5c", 0x200004, 0x80000, CRC(4ad13297) SHA1(59565f9819e1cdd405103d5e3621c747116f653c) )
+ ROM_LOAD64_WORD( "10.5f", 0x200006, 0x80000, CRC(026d0cd2) SHA1(44f7718851e0b1f43682afafcbd844e6b1ce3430) )
+
+
+ ROM_REGION( 0x18000, "audiocpu", 0 ) /* 64k for the audio CPU (+banks) */
+ ROM_LOAD( "pa3_11.11f", 0x00000, 0x08000, CRC(cb1423a2) SHA1(3191bf5d340168647881738cb2aed09b1d86146e) ) // == 11.11f has the same content of pa3w_16.10l from pang3 romset
+ ROM_IGNORE( 0x18000 )
+
+ ROM_REGION( 0x40000, "oki", 0 ) /* Samples */
+ ROM_LOAD( "pa3_05.10d", 0x00000, 0x20000, CRC(73a10d5d) SHA1(999465e4fbc35a34746d2db61ad49f61403d5af7) ) // 5.10c has the same content of pa3_05.10d from pang3 romset
+ ROM_LOAD( "pa3_06.11d", 0x20000, 0x20000, CRC(affa4f82) SHA1(27b9292bbc121cf585f53297a79fe8f0d0a729ae) ) // 6.11c has the same content of pa3_06.11d from pang3 romset
+
+ ROM_REGION( 0x0200, "aboardplds", 0 )
+ ROM_LOAD( "buf1", 0x0000, 0x0117, CRC(eb122de7) SHA1(b26b5bfe258e3e184f069719f9fd008d6b8f6b9b) )
+ ROM_LOAD( "ioa1", 0x0000, 0x0117, CRC(59c7ee3b) SHA1(fbb887c5b4f5cb8df77cec710eaac2985bc482a6) )
+ ROM_LOAD( "prg1", 0x0000, 0x0117, CRC(f1129744) SHA1(a5300f301c1a08a7da768f0773fa0fe3f683b237) )
+ ROM_LOAD( "rom1", 0x0000, 0x0117, CRC(41dc73b9) SHA1(7d4c9f1693c821fbf84e32dd6ef62ddf14967845) )
+ ROM_LOAD( "sou1", 0x0000, 0x0117, CRC(84f4b2fe) SHA1(dcc9e86cc36316fe42eace02d6df75d08bc8bb6d) )
+
+ ROM_REGION( 0x0200, "bboardplds", 0 )
+ ROM_LOAD( "cp1b1f_boot.1f", 0x0000, 0x0117, CRC(658849dc) SHA1(4fc386fa33322ce52334dee1391d617e0754bde0) )
+ ROM_LOAD( "cp1b8k.8k", 0x0000, 0x0117, CRC(8a52ea7a) SHA1(47a59abc54a83292cfd6faa2d293c8f948c7ea03) ) // I was not able to dump the original PAL. Tryied to swap it with a legit CP1B8K on real hw
+ // and it's working, so I suppose they're functionally equivalent
+ ROM_LOAD( "cp1b9ka.9k", 0x0000, 0x0117, CRC(238d3ff4) SHA1(597f429d6a0ea485746322592604188c1ec87595) ) // The PAL @ 9k was bruteforced and verified to be to be functionally equivalent to a standard cp1b9ka
+
+ ROM_REGION( 0x0200, "cboardplds", 0 )
+ ROM_LOAD( "ioc1.ic7", 0x0000, 0x0104, CRC(a399772d) SHA1(55471189db573dd61e3087d12c55564291672c77) )
+ ROM_LOAD( "c632.ic1", 0x0000, 0x0117, CRC(0fbd9270) SHA1(d7e737b20c44d41e29ca94be56114b31934dde81) )
+ROM_END
+
+
+
+
/* B-Board 91635B-2 */
/* Note that this USA set seems to be the only one where GFX are stored into EPROMs instead of the usual mask ROMs. */
ROM_START( megaman )
@@ -13956,6 +14145,69 @@ void cps_state::init_pang3()
init_pang3b();
}
+/*
+Pang 3b4 - code accesso to $5762b0 and $57a2b0 (PIC)
+
+--------- Dip switch decoding ---------
+0E001A: move.b $80001c.l, D0 ; !Dip switch B
+0E0020: not.b D0 ; Dip switch B
+0E0022: move.b D0, D1 ; D1 = D0 - Save DSWB for later use
+0E0024: andi.b #$7, D0 ; D0 = D0 & $7 - first 3 bits - Game level -- 7<= D0 <= 0
+0E0028: move.w D0, $5762b0.l ; [$5762b0] = D0
+0E002E: nop ;
+0E0030: move.w $57a2b0.l, D2 ; D2 = [$57a2b0]
+0E0036: move.b D1, D0 ; D0 = D1 - restore value read from DSWB
+0E0038: andi.w #$60, D0 ; D0 = D0 & $60 - bit 5, 6
+
+--------- Copy protection ? ---------
+000300: move.w #$17, $5762b0.l ; [5762B0] = 17 (Pic?)
+000308: nop ;
+00030A: move.w #$3, D2 ; D2 = 3
+00030E: move.w $57a2b0.l, D0 ; D0 = [$57A2B0]
+000314: cmpi.w #$7321, D0 ; DO <= $7321 (not used?)
+000318: bra $360 ; jmp 360
+; unused code
+00031A: dbra D2, $30e ; loop until D2=0 to $30E
+00031E: move.l #$0, $ff10fa.l ; [$ff10fa] = 0 ; reset values initialized at 238F0-23922
+000328: move.l #$0, $ff113a.l ; [$ff113a] = 0 ; reset values initialized at 238F0-23922
+000332: move.l #$0, $ff10fe.l ; [$ff10fe] = 0 ; reset values initialized at 238F0-23922
+00033C: move.l #$0, $ff113e.l ; [$ff113e] = 0 ; reset values initialized at 238F0-23922
+000346: move.l #$0, $ff10d2.l ; [$ff10d2] = 0 ; reset values initialized at 238F0-23922
+000350: move.l #$0, $ff1112.l ; [$ff1112] = 0 ; reset values initialized at 238F0-23922
+00035A: jmp $20acc.l ; jmp $20ACC
+; unused code [END]
+000360: jmp $e0000.l ; jmp $E0000
+*/
+uint16_t cps_state::pang3b4_prot_r()
+{
+
+ if ((pang3b4_prot & 0xFF) >=0 && (pang3b4_prot & 0xFF) <=7)
+ return (pang3b4_prot & 0xFF)+0x20; // Game level + extend
+ if (pang3b4_prot == 0x17)
+ return 0x7321; // Guessed from code @0x314
+ return 0xFFFF;
+}
+
+void cps_state::pang3b4_prot_w(uint16_t data)
+{
+ pang3b4_prot = data;
+}
+
+
+void cps_state::init_pang3b4()
+{
+ m_maincpu->space(AS_PROGRAM).install_write_handler(0x5762b0, 0x5762b1, write16smo_delegate(*this, FUNC(cps_state::pang3b4_prot_w)));
+ m_maincpu->space(AS_PROGRAM).install_read_handler(0x57A2b0, 0x57A2b1, read16smo_delegate(*this, FUNC(cps_state::pang3b4_prot_r)));
+
+ /* In pang3 the Mach215 security chip outputs 2 control signals (pins 4, 6) which switch the eeprom in/out serial data lines onto the main 68k data bus when required
+ They're mapped in the CPS-B address range but there is not the EPROM on the board
+ Read and write to port 0x80017a still are present in the code, but they are filtered by the PAL16V8 @ E13 */
+ m_maincpu->space(AS_PROGRAM).nop_readwrite(0x80017a, 0x80017b);
+
+ init_cps1();
+}
+
+
uint16_t cps_state::ganbare_ram_r(offs_t offset, uint16_t mem_mask)
{
uint16_t result = 0xffff;
@@ -14283,6 +14535,8 @@ GAME( 1995, pang3j, pang3, pang3, pang3, cps_state, init_pang3
GAME( 1995, pang3b, pang3, pang3, pang3b, cps_state, init_pang3b, ROT0, "bootleg", "Pang! 3 (bootleg, set 1)", MACHINE_SUPPORTS_SAVE ) // 950511 - based on Euro version
GAME( 1995, pang3b2, pang3, pang3, pang3, cps_state, init_pang3, ROT0, "bootleg", "Pang! 3 (bootleg, set 2)", MACHINE_SUPPORTS_SAVE ) // 950601 - based on Euro version
GAME( 1995, pang3b3, pang3, pang3, pang3, cps_state, init_pang3, ROT0, "bootleg", "Pang! 3 (bootleg, set 3)", MACHINE_SUPPORTS_SAVE ) // 950511 - based on Euro version, hacked to use cps-b-17
+GAME( 1995, pang3b4, pang3, cps1_12MHz, pang3b4, cps_state, init_pang3b4, ROT0, "bootleg", "Pang! 3 (bootleg, set 4)", MACHINE_SUPPORTS_SAVE ) // 950601 - based on Euro version, unencrypted, protection PIC, no serial EPROM
+GAME( 1995, pang3b5, pang3, pang3, pang3, cps_state, init_pang3, ROT0, "bootleg", "Pang! 3 (bootleg, set 5)", MACHINE_SUPPORTS_SAVE ) // 950511 - based on Euro version
/* Home 'CPS Changer' Unit */